outlook anywhere internal hostname

PramoIT
PramoIT used Ask the Experts™
on
Hi,

We have an exchange 2010 server. We have renewed our certificates. Because internal servernames cant be included in the certificates anymore, we have changed the internal hostnames for owa, ecp, oab etc etc. But we cant change the internal hostname for outlook anywhere.

Now the clients keep getting certificate mismatch error after starting outlook.

I was trying to change the internal hostname with the following command.

Set-OutlookAnywhere -Identity "HostName\Rpc (Default Web Site)" -InternalHostname mail.mydomain.com -InternalClientsRequireSsl $true

A positional parameter cannot be found that accepts argument '-InternalHostname'.
   + CategoryInfo          : InvalidArgument: (:) [Set-OutlookAnywhere], ParameterBindingException
   + FullyQualifiedErrorId : PositionalParameterNotFound,Set-OutlookAnywhere

Any help is apreciated.

Regards
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
IvanSystem Engineer

Commented:
Hi,

you should first create DNS zone for you public name, eg. mydomain.com and point mail record to you exchange server, it's internal ip address, so that internal client connect directly to it.

After that you should reconfigure AutoDiscover for internal clients:
Set-ClientAccessServer -Identity Servername –AutoDiscoverServiceInternalUri https://mail.mydomain.com/Autodiscover/Autodiscover.xml 

To check current AutoDiscover settings:
Get-ClientAccessServer |fl identity,autodiscoverserviceinternaluri

Change WebServices as well.
To check current setting:
Get-WebServicesVirtualDirectory |fl identity,internalurl

To reconfigure it:
Set-WebServicesVirtualDirectory -Identity “Hostname\EWS (Default Web Site)” -InternalUrl https://mail.mydomain.com/EWS/Exchange.asmx -BasicAuthentication:$true

After this, there should not be certificate mismatch.

Regards,
Ivan.

Author

Commented:
I've already set the autodiscover and web service virtual directory to point internal url to mail.mydomain.com. That works fine.

Outlook anywhere internal hostname has to be changed, why isn't above command working?
IvanSystem Engineer

Commented:
I don't think there is InternalHostname switch in that command.

If you check available parameters for that command, there is no InternalHostname switch.

https://technet.microsoft.com/en-us/library/bb124993(v=exchg.141).aspx

Regards,
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Author

Commented:
This link is not for set-oulookanywhere, but for enable-outlookanywhere
I mean this https://technet.microsoft.com/en-us/library/bb123545(v=exchg.150).aspx

But after looking further, i see this is for exchange 2013. For exchange 2010 https://technet.microsoft.com/en-us/library/bb123545(v=exchg.141).aspx

there is indeed no internalhostname option for set-outlookanywhere in 2010

What can we do else, what you stated before has already been done except for the dns part. DNS is for the public zone is set up externally.
Shreedhar EtteTechnical Manager
Top Expert 2010

Commented:
Hi,

Make sure that you have set the External Hostname set to mail.mydomain.com as per the attached snapshot.
OA.PNG
Administrator- Data Center & Network
Commented:
Check out the below nice article from DigiCert.

https://blog.digicert.com/exchange-replacing-internal-names-certificates-part-2/

Read the details in "OutlookAnywhere Setting"

Zac.

Author

Commented:
Hi Shreedhar, the external hostname for outlook anywhere is already set correct.

Hi Zacharia, I've already read that article. I've ran the tool and all the exchange services already have the internal url's point to the external names.

So that part is ok. Now the outlook anywhere part.

According to the article I have to run the following command to check wether i have to set outlook anywhere or not.

Get-OutlookAnywhere -Identity "HostName\Rpc (Default Web Site)" | fl InternalHostname, InternalClientsRequireSsl

The output of this command is nothing, empty, no text at all. See attached screenshot "screen1"

In "screen2" you can see the result of the command
Get-OutlookAnywhere -Identity "Hostname\Rpc (Default Web Site)"

Behind the blue color there is the internal hostname and/or local domain.
Behind the green color there is the external hostname mail.mydomain.com

In "screen3 certwarning" you can see the certificate warning. This warning can only be caused by the internal hostname of outlook anywhere. All the rest is set to external urls. As you can see in "screen4" and "screen5"

One last thing, the certificate error only occurs on outlook clients that reside on the same network as the exchange server. External outlook clients don't get the certificate error.

Regards,
screen1.PNG
screen2.PNG
screen3-certwarning.PNG
screen4-outlooksettings.PNG
screen5-outlooksettings.PNG
Zacharia KurianAdministrator- Data Center & Network

Commented:
Could you try running ExRCA and post the details?

Zac.
Zacharia KurianAdministrator- Data Center & Network

Commented:
Just forgot about DNS. Have you set up DNS records to resolve the external domain names to the internal IP address?

For example;
 your internal exchange name "exsrv.abcd.local points to 192.168.1.1
your public exchnage name is "email.abcd.com"
then add a DNS record for email.abcd.com pointing to 192.168.1.1, in your AD DNS.
 
Zac.
Commented:
Hi,

See screen6.

Yes, i have pointed the external name to the internal ip address in DNS.

One thing i found out. When creating a new profile in outlook the certificate warning disappears.

Regards,
screen6.PNG
Zacharia KurianAdministrator- Data Center & Network

Commented:
Would it be a big deal to recreate the profile for your users? How many users do you have?

Another work around is to either use wildcard SAN  SSL or create an internal cert.

Zac.

Author

Commented:
I think it's best to recreate the profles.

What about the self signed certificate? In exchange you can just attach 1 certificate to iis. How would you do that?

Regards,
Zacharia KurianAdministrator- Data Center & Network

Commented:
Forget about it (self signed). It was just a TYPO error

So if you can't afford a wild card cert, then go for the recreating the profile.

Zac.

Author

Commented:
After doing all the necessary steps, the outlook profiles have to be recreated.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial